APromptRiskDBThreat intelligence atlas
AI Mitigation

Single-User AI Agent Permissions Configuration - AI Mitigation

When deploying an AI agent that acts as a representative of a user and performs actions on their behalf, it is important to implement robust policies and controls on permissions and lifecycle management of the agent. Lifecycle management involves establishing identity, protocols for access management, and decommissioning of the agent when its role is no longer needed. Controls should also include the principle of...

View mitigationsRead context
AI MitigationDeploymentTechnical - Cyber

Record summary

A quick snapshot of what this page covers.

Techniques7Attacks this defense is designed to help with.
Lifecycle1Where this defense applies in the AI lifecycle.
Categories1How the source groups this defense.

Control summary

What this defense is meant to help prevent.

When deploying an AI agent that acts as a representative of a user and performs actions on their behalf, it is important to implement robust policies and controls on permissions and lifecycle management of the agent. Lifecycle management involves establishing identity, protocols for access management, and decommissioning of the agent when its role is no longer needed. Controls should also include the principle of least privilege and delegated access from the user account. When acting as a representative of a user, the AI agent should not be granted permissions that the user would not be granted within the system or organization.

ATLAS ID
AML.M0027
Priority score
35
Deployment
Technical - Cyber

Covered techniques

Attacks this defense is designed to help with.

AML.T0053 - AI Agent Tool Invocation

demonstrated

Configuring AI agents with permissions that are inherited from the user for tool use can limit an adversary's ability to abuse tool invocations if the agent is compromised.

AML.T0085.001 - AI Agent Tools

demonstrated

Configuring AI agents with permissions that are inherited from the user can limit an adversary's ability to collect data from agent tool invocation if the agent is compromised.

AML.T0085 - Data from AI Services

demonstrated

Configuring AI agents with permissions that are inherited from the user can limit an adversary's ability to collect data from AI services if the agent is compromised.

AML.T0082 - RAG Credential Harvesting

demonstrated

Configuring AI agents with permissions that are inherited from the user can limit an adversary's ability to harvest credentials from RAG Databases if the agent is compromised.

AML.T0085.000 - RAG Databases

demonstrated

Configuring AI agents with permissions that are inherited from the user can limit an adversary's ability to collect data from RAG Databases if the agent is compromised.

Source

Where this page information comes from.